Full Report
Discover how to secure AI agents in your cloud environment with Tenable One Cloud Exposure. We explore Microsoft Entra Agent ID and provide essential best practices for robust agentic AI identity security.Key takeawaysUnderstand your current maturity level and then build an appropriate action plan to secure your agent identities.Use your cloud providers’ native tools or Tenable One Cloud Exposure to locate and catalog every AI agent operating in your environment.Do not assign human identities or over-privileged service accounts to the AI agents your vendors deploy in your environment. Instead, require that vendors adopt official models like Microsoft Entra Agent ID for their AI agents’ identities.As AI agents move from experimental toys to tools that make autonomous decisions, interact with databases, and call external APIs, organizations need to be clear on who — or what — is executing these actions in their cloud environments.Why non-human identities (NHIs) aren’t secure enough for AI agentsSecurity teams categorize identities into two buckets: human identities and non-human identities (NHIs), such as service accounts, secrets, and automated scripts.Treating AI agents as standard NHIs is a recipe for disaster. AI agents combine their non-deterministic nature with their ability to execute flexible, outcome-oriented actions, rather than following strict, prescribed instructions. Unlike classic, predictable scripts that follow rigid code paths, AI agents:Make creative, runtime decisions using LLMs.Interact with dynamic external tools, memory caches, and knowledge bases.Constantly adapt to solve problems, making it difficult for a security team to establish AI agents’ baseline behavior.To address this challenge, major cloud providers have introduced dedicated, specialized agentic AI identity models. Let’s break down one major model: Microsoft Entra Agent ID.Microsoft Entra Agent IDFeature / dimensionMicrosoft Entra Agent IDPrimary architectureIdentity provider-centric (built on Entra ID)Target scopeAny AI platform, including Microsoft Copilot, Microsoft Foundry, and third-party platforms not hosted on AzureIdentity componentsFour-object model: Agent identity blueprint, agent identity blueprint principal, agent identity, agent userHardening mechanismPermission boundaries and cascade rules; “On-behalf-of” user plus agent dual authenticationDeveloper complexityHigher, due to dealing with a multi-object model, with cross-tenant considerationsVisibility / scopeExcellent, since it covers unmanaged and external SaaS-based agentsAnnouncing Tenable One Cloud Exposure support for Microsoft Entra Agent IDIdentity and cloud providers' native identity management tools present only basic information about agentic identities, without providing context about their security flaws and how they extend your attack surface. Because AI agents are becoming a new class of identity with real permissions, you must understand how an attacker could compromise and abuse them. At Tenable, we believe visibility is the foundation of security. You can’t secure assets that you do not know exist.As organization-wide adoption of agentic AI accelerates, the immediate challenge for security teams is first and foremost finding them. Because these identities are brand new, conventional identity and access management (IAM) systems may not recognize or monitor them, which creates security blind spots.To help our customers address this issue, Tenable One Cloud Exposure now brings Microsoft Entra agentic AI identities directly into your unified asset and identity inventory.Microsoft Entra Agent ID ModelThe Microsoft Entra Agent ID framework functions through a four-tiered structural model:Agent identity blueprints serve as the master templates for shared attributes. Residing exclusively within the agent provider’s home tenant, they establish cross-tenant links that heighten exposure to potential supply-chain attacks.Agent identity blueprint principals are the localized instantiation of a blueprint within every specific tenant where the AI agent is deployed and active.Agent identities represent the functional identities utilized for routine tasks. To maintain oversight of agent behavior, these are the primary entities your security team must monitor.Agent users offer an optional layer for each agent identity requiring human-centric features — like Microsoft Teams access or a personal mailbox — to function effectively as integrated “digital colleagues.”Bringing order to Microsoft Entra ‘robot sprawl’Watch the quick walkthrough below to see how Tenable One Cloud Exposure discovers, inventories, and maps your Microsoft Entra agentic AI identities.How to uncover AI agent identitiesAt the recent fwd:cloudsec North America 2026 conference in Bellevue, Wash., my fellow Tenable researcher Ron Popov and I took the stage to address this exact challenge in our talk, “Who Are the Robots? Uncovering AI Agents’ Identities.”If you missed our live session or want to dive deep into the technical architecture of agentic identity, please watch our full presentation in the video below.Ready to unmask your robots?Don’t let autonomous agents become dangerous blind spots in your cloud environments. Discover Tenable One Cloud Exposure today to see how Tenable’s unified identity inventory can help you gain broader visibility over your Microsoft Entra AI agent footprint.
Analysis Summary
# Best Practices: Securing AI Agent Identities in Cloud Environments (Microsoft Entra Agent ID)
## Overview
AI agents are becoming a new class of identity. Unlike traditional service accounts or scripts, they make runtime decisions with LLMs, call external APIs, and access databases, so they can act with real permissions in ways that are hard to predict. Many security teams cannot yet see these agents, and native cloud IAM tools show only basic information about them. These practices focus on three things: discovering and inventorying every agent, governing how agents are identified and what they can access, and preventing vendors or internal teams from deploying agents with over-privileged or human identities. The primary reference is Microsoft Entra Agent ID, which uses a four-object identity model.
## Key Recommendations
### Immediate Actions
1. **Assess your current maturity.** Rate where you stand on agent visibility, identity model, permissions governance, and monitoring (for example, Initial, Developing, Defined, Managed). Use the rating to set the scope of your action plan.
2. **Discover and inventory all AI agents.** Use native cloud provider tools or a CNAPP such as Tenable One Cloud Exposure to find every AI agent running in your environment, including those in SaaS platforms and third-party tools. Record each agent's owner, purpose, platform, and identity type.
3. **Map the Entra Agent ID objects in your tenant.** For each agent, identify its four components: agent identity blueprint (master template, usually in the vendor's home tenant), agent identity blueprint principal (local instance in your tenant), agent identity (the functional identity you should monitor), and agent user (optional, for agents with human-style access such as Teams or mailboxes).
4. **Stop assigning human identities to agents.** Identify any agent running under a user account or a shared credential and plan migration to a dedicated agent identity.
5. **Remove over-privileged service accounts used by agents.** Review the permissions of each agent identity and revoke any that are not required for its documented tasks.
6. **Require Entra Agent ID from vendors.** Add a contract or procurement requirement that vendor-deployed AI agents use official agent identity models such as Microsoft Entra Agent ID, not human identities or generic service accounts.
### Short-term Improvements (1-3 months)
1. **Establish a dedicated agent identity for each agent.** Create a separate identity per agent rather than sharing identities across agents or workloads, so actions can be attributed and scoped.
2. **Apply least privilege with permission boundaries.** Use Entra's permission boundaries and cascade rules to limit what each agent identity can do, including what it can delegate.
3. **Use on-behalf-of plus agent dual authentication where user context is needed.** When an agent acts for a user, ensure both the user and the agent are authenticated and authorized, so the agent cannot exceed the user's rights.
4. **Build a baseline of agent behavior.** Because agents adapt at runtime, log their API calls, data access, and tool use, and set alerts for deviations from observed patterns.
5. **Assess blueprint and supply-chain exposure.** Identify which agent blueprints are hosted in external tenants, since these create cross-tenant links that can be targeted in supply-chain attacks. Review vendor security posture for each.
6. **Define ownership and lifecycle processes.** Assign an accountable owner to each agent, and require review and decommissioning when the agent is no longer needed.
### Long-term Strategy (3+ months)
1. **Integrate agent identities into your unified identity inventory.** Bring Entra agent identities into the same inventory and risk view as human and other non-human identities, so agents are governed under existing identity programs.
2. **Continuously map attack paths.** Assess how an attacker could compromise or abuse agent identities and what other resources they can reach. Prioritize fixes by exploitability and impact.
3. **Implement continuous access reviews.** Recertify agent permissions on a regular schedule and after any change in the agent's role, tools, or data sources.
4. **Standardize agent onboarding.** Create a secure intake process for new agents covering identity model, permissions, logging, owner assignment, and vendor requirements before deployment.
5. **Measure and report.** Track metrics such as percentage of agents with dedicated identities, number of agents with excess permissions, time to decommission unused agents, and number of unidentified agents discovered.
## Implementation Guidance
### For Small Organizations
- Start with a manual inventory of AI tools and agents, including SaaS-based ones, in a spreadsheet with owner, purpose, and identity type.
- Use built-in cloud provider tools (for example, Entra admin center reporting) to find agent identities.
- Remove any agent using a personal or admin account and replace it with a dedicated identity.
- Require vendors to state in writing how their agents authenticate and what permissions they need.
- Review agent permissions quarterly.
### For Medium Organizations
- Deploy a CNAPP or identity security tool to automate discovery across cloud and SaaS platforms.
- Create an agent registry with owner, data classification, permissions, and review date for each agent.
- Enforce separate identities per agent and apply permission boundaries.
- Add agent logs to your SIEM and create baseline alerts for unusual API or data access.
- Assign an identity or security team member to own agent governance.
### For Large Enterprises
- Integrate agent identity discovery into your CIEM, ITDR, and CNAPP programs with unified inventory across tenants and clouds.
- Monitor cross-tenant blueprint links and third-party agent supply chains as part of vendor risk management.
- Define enterprise policies for agent creation, privilege ceilings, delegation rules, and decommissioning.
- Use automated access reviews and attack path analysis to continuously reduce agent-related risk.
- Establish a governance committee spanning security, identity, cloud, legal, and business units to approve high-risk agent deployments.
## Configuration Examples
The source article does not provide specific configuration steps, CLI commands, or policy code. It describes these configuration concepts, which you can apply in your Entra environment:
- **Agent identity per agent:** Each agent gets its own agent identity; do not share identities.
- **Permission boundaries and cascade rules:** Restrict the maximum permissions an agent identity can hold or pass to other agents.
- **Dual authentication for on-behalf-of flows:** Require both user and agent authentication when an agent acts for a user.
- **No human identities for agents:** Block agent use of user accounts; use agent users only where human-style features such as Teams or a mailbox are required.
Consult Microsoft Entra Agent ID documentation on Microsoft Learn for exact configuration steps.
## Compliance Alignment
These mappings are general recommendations and are not stated in the source article:
- **NIST SP 800-207 (Zero Trust Architecture):** Apply per-request authentication and least privilege to every agent identity.
- **NIST CSF 2.0:** Govern (ownership and policy), Identify (agent inventory), Protect (identity and permission controls), Detect (behavioral monitoring).
- **ISO/IEC 27001:2022 Annex A:** Controls on identity management (5.16), authentication information (5.17), and access rights (5.18), and privileged access (8.2).
- **CIS Controls v8:** Control 5 (Account Management), Control 6 (Access Control Management), and Control 1 (Enterprise Asset Inventory), extended to non-human identities.
## Common Pitfalls to Avoid
- **Treating agents as standard service accounts.** Agents are non-deterministic and adapt at runtime, so static NHI controls are not sufficient.
- **Assigning human identities to agents.** This breaks attribution and can give agents the full rights of a person.
- **Over-privileged agent identities.** Granting broad permissions for convenience expands the blast radius of any compromise.
- **Ignoring vendor-deployed agents.** Agents deployed by vendors in your tenant are still your risk; require compliant identity models.
- **Overlooking SaaS and unmanaged agents.** Shadow agents on external platforms can remain invisible without dedicated discovery.
- **Ignoring cross-tenant blueprint links.** These can create supply-chain exposure if the provider tenant is compromised.
- **Relying on native tools alone.** Native tools show limited context about security flaws and attack paths.
- **Treating inventory as a one-time task.** Agents proliferate quickly; discovery and access reviews must be continuous.
- **Leaving agents without owners.** Orphaned agents accumulate permissions and risk.
## Resources
- Tenable One Cloud Exposure (CNAPP): hxxps://www[.]tenable[.]com/cloud-security/products/cnapp
- Tenable blog source article: hxxps://www[.]tenable[.]com/blog/secure-ai-agent-identities-microsoft-entra-agent-id-tenable-one
- Tenable talk "Who Are the Robots? Uncovering AI Agents' Identities" (fwd:cloudsec North America 2026): hxxps://fwdcloudsec[.]org/conference/north-america/
- Presentation video: hxxps://www[.]youtube[.]com/watch?v=mMxACHKIAwY
- Microsoft Entra Agent ID documentation: search "Microsoft Entra Agent ID" on Microsoft Learn (hxxps://learn[.]microsoft[.]com)
- NIST SP 800-207, Zero Trust Architecture: hxxps://csrc[.]nist[.]gov/pubs/sp/800/207/final
- CIS Controls v8: hxxps://www[.]cisecurity[.]org/controls